CVE-2026-99102

In the Linux kernel, the following vulnerability has been resolved:

ntfs: take invalidate lock in ntfs setattr size()

ntfs setattr size() updates i size and resizes the on-disk attribute without holding mapping->invalidate lock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN against the transient runlist state of ntfs non resident attr expand() and fail with a spurious SIGBUS, and can interleave with the size-change epilogue (truncate pagecache(), i size write(), pagecache isize extended()).

Take invalidate lock exclusively around the whole resize after inode dio wait(), matching the fallocate path and other filesystems such as xfs, which wraps truncate in its mmaplock (= invalidate lock).